feat: add internal Services for interserver and operator traffic

[GrigoryPervakov]

Why

It is the first stage for #266
Need to separate internal and client traffic to control it separately later.

It may make more sense to use a governing service for internal traffic, but it already exists and serves client traffic

What

Add per-replica services with internal-only ports and configure clickhouse to use it for internal replication and operator access

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 20 changed files in this pull request and generated no new comments.

Suppressed comments (1)

test/testutil/dialer.go:170

• podForHostname() rejects internal Service names that appear truncated (63 chars with a 4-hex hash before "-internal-") by returning an error. This truncation pattern is produced by api/v1alpha1/common.go:resourceName() when the base name is too long, so long ClickHouseCluster names will make InternalServiceNameByReplicaID() hit this path and break port-forwarding (the dialer will fail before even attempting portforward). Consider resolving Service hostnames to Pods via the Kubernetes API (e.g., get Service -> use its selector or Endpoints to pick the target Pod) instead of relying on reconstructing the Pod name from the Service name, so truncated resource names still work.

	hashStart := internalServiceIndex - resourceNameHashLength
	if len(serviceName) == maxKubernetesResourceNameLength && hashStart > 0 && serviceName[hashStart-1] == '-' {
		_, err := strconv.ParseUint(
			serviceName[hashStart:internalServiceIndex], 16, resourceNameHashLength*4,
		)

[mintlify]

Docs PR opened: ClickHouse/ClickHouse#113871

Updated two AdditionalPort descriptions in the Kubernetes Operator API reference to say "public headless Service" instead of "operator-managed".